Please AMEND the SPECIFICATION as follows: 
Please amend page 14, line - page 15, line 2 as follows: 

As described above with reference to FIG. 4, translation and routing tables may be 
updated when a packet is transmitted from within a VPN to a node outside the VPN. Figure 
5 is a process flow diagram illustrating a method of processing a packet by a service provider 
network NAT device in accordance with various embodiments of the invention that is 
received from outside the VPN and addressed to a node inside the VPN. As will be 
described in further detail below, the NAT device may maintain a plurality of routing tables, 
each of the routing tables being associated with a different one of a plurality of VPNs at 502. 
The NAT device may receive a packet at 504, wherein the packet includes an IP source 
address and an IP destination address, as well as information indicating one of the plurality 
of routing tables to route the packet. As shown at block 506 # 02, the NAT device may 
perform NAT on the packet is performed . For instance, as described above, the MPLS tag 
may identify the network device responsible for performing NAT and routing the packet. In 
addition, the MPLS tag may also identify the VPN network. Thus, the VPN may be 
ascertained from the MPLS tag in order to identify an entry in a translation table such as that 
described above with reference to Figure 4. Once an entry in the translation table is 
identified using the IP source address (and/or port), the IP destination address (and/or port), 
and the VPN identifier obtained from the packet, NAT is performed on the packet using the 
contents of the translation table entry. 

Once NAT has been performed, the packet may be routed. Specifically, one of the 

plurality of routing tables maintained by the service provider network device must be 

identified at block #04 508 in order to route the packet. As described above, the VPN and/or 

VRF table identifier is identified in an MPLS tag in accordance with one embodiment. This 
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VPN identifier is also preferably stored in the translation table entry. Thus, the appropriate 
routing table associated with a specific VPN may be identified using the VPN identifier 
obtained from the MPLS tag or, alternatively, from the VPN identifier stored in the 
translation table entry previously used to perform NAT on the packet. 

Upon identification of the routing table associated with the VPN, an entry in the 
routing table is identified using the IP source address and the IP destination address in the 
packet as shown at block 510 §06. The packet is then routed using the identified routing 
table entry at block 512 #08. 

The NAT device may receive a default route to a network device providing one or 
more shared services at 514. For example, the default route may be advertised by the 
network device providing one or more shared services, where each of the shared services is 
available to each of the VPNs. The NAT device may then update each of the plurality of 
routing tables to include the default route to the network device providing one or more 
shared services available to each of the VPNs at 516. 
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